Privacy Policy

This Privacy Policy explains how we collect, use, share and protect personal information, and the rights and choices you have. This summary is for convenience. The full policy below controls.

1. Who we are

Wave Intelligence, Inc. is a Delaware corporation. We are the controller of the personal information described in this policy, which means we decide how and why it is used. The exception is information we process on behalf of our customers, described in section 2.

You can contact us about privacy at any time at samet@waveone.io.

2. What this policy covers

This policy applies to:

• our website at waveone.io and its subdomains (the "Website");
• the Wave platform, bulletins and related services (the "Service");
• business contact information we collect from public sources to provide the Service ("Business Contact Data");
• our sales, marketing and support communications.

It does not cover Customer Data: information our customers upload or add to the Service, such as a customer list used for lookalike matching, notes about leads or contacts imported from a CRM. We process Customer Data on behalf of our customers and under their instructions, so the customer's own privacy notice applies. If you have questions about Customer Data, please contact the customer concerned.

This policy also doesn't cover third-party websites or services you reach through the Website or connect to the Service, such as CRM tools. Their own privacy policies apply.

3. Information you give us

• Demo and trial requests: your name, work email, company, phone number (optional), what your company sells, your target market or country and your preferred bulletin frequency.
• Account information: your name, email address, company, role, the teammates you invite and your settings, such as saved filters and customer profiles.
• Billing information: payments are handled by our payment processor, Stripe. We receive limited billing details, such as your name, billing address, the last four digits and expiry date of your card and the payment status. We don't receive or store full card numbers.
• Communications: when you email us or talk with our team, we keep the content of those conversations and our replies.

4. Information we collect automatically

• Server and security logs: when you visit the Website, our hosting and content delivery provider, Cloudflare, processes technical information such as your IP address, browser type, device information, the pages you request and the date and time of each request. This is needed to deliver the Website and protect it against attacks and abuse.
• Campaign information: if you arrive through a link that contains campaign parameters (for example utm_source or an ad click identifier such as gclid), or from another website, the Website keeps that information in your browser for the current visit. It is sent to us only if you submit a form, so we can understand which campaigns bring in requests.
• Browser storage: the Website stores a small amount of information in your browser, as described in our Cookie Policy.
• Platform usage data: when you use the Service, we record actions such as sign-ins, bulletins opened, exports and emails sent, to provide the Service, keep it secure and improve it.

We don't currently use analytics or advertising tools on the Website. If we add them, we will update this policy and our Cookie Policy and ask for your consent where the law requires it.

5. Business contact data from public sources

Wave helps companies reach businesses that have just opened. To do that, we use automated systems, including AI models, to find newly opened businesses and collect information they have made publicly available.

Where it comes from

• business websites;
• online business directories and map listings;
• public social media pages and profiles of businesses;
• public registries and other publicly available sources.

What we collect

Business name, category and descriptive labels (for example "specialty coffee" or "seats 40+"), business address and location, opening date, business phone numbers and email addresses, website and social media profiles and, where a business publishes them, the names and roles of its owners or managers. Where we can, we check that contact details are valid, for example that an email address can receive mail.

How we use it

We use Business Contact Data to compile bulletins, to rank how closely each business matches a customer's target profile (the "fit score") and to let customers contact businesses and add them to their CRM. Fit scores help our customers prioritize sales outreach. They don't produce legal or similarly significant effects for the people concerned.

Much of this information is about businesses rather than individuals. Some of it, such as an owner's name or an email address or phone number that identifies a person, is personal information, and we handle it as this policy describes. We don't intentionally collect sensitive information, such as information about health, religion or political opinions, and we delete it if we find that we have collected it.

6. How we use information

• to provide, operate and maintain the Website and the Service, including bulletins, contact tools, email automation and integrations;
• to respond to demo and trial requests and send you the bulletins you ask for;
• to create and manage accounts, process payments and send service and billing messages;
• to send marketing about Wave to business contacts, with an easy way to opt out and with consent where the law requires it;
• to understand which campaigns and pages work and to improve the Website and the Service, including our matching models;
• to protect the Website, the Service and our users, prevent fraud and abuse and enforce our Terms of Use;
• to comply with legal obligations and respond to lawful requests.

We may also create aggregated or de-identified information that can't reasonably be used to identify you, and use it for any lawful purpose.

7. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

• Contract: to provide the Service you signed up for and to manage your account and payments.
• Legitimate interests: to run and secure the Website, respond to enquiries, market Wave to businesses, improve the Service and collect and provide publicly available Business Contact Data so that companies can offer their products and services to newly opened businesses. We have balanced these interests against the rights of the people concerned: we use only information that businesses have made public, we limit it to business contact information, and anyone can object or ask us to remove it at any time.
• Consent: where the law requires it, for example for certain marketing messages or non-essential cookies. You can withdraw your consent at any time.
• Legal obligation: for example to keep tax and accounting records or to respond to lawful requests from authorities.

If you are in Türkiye, we rely on the legal bases in Article 5(2) of Law No. 6698 on the Protection of Personal Data ("KVKK"): the establishment or performance of a contract, compliance with a legal obligation, data made public by the data subject and our legitimate interests, and on explicit consent where it is required. Our KVKK Notice explains this in Turkish.

8. How we share information

• Our customers: we provide Business Contact Data to customers in bulletins and through the Service. Customers agree in our Terms of Use to use it only for lawful business outreach, to comply with applicable marketing and privacy laws and to honor opt-out requests.
• Service providers that help us run Wave, for example hosting and content delivery (Cloudflare), email and productivity tools (Google Workspace), payment processing (Stripe), email delivery and AI and data processing providers. They may use personal information only to provide their services to us.
• Integrations you choose: when you connect a third-party service, such as a CRM, we send data to it at your direction.
• Legal and safety reasons: when we believe in good faith that the law requires it, or to protect the rights, property or safety of Wave, our users or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business.
• With your consent or at your direction.

We do not sell the personal information of our website visitors or customers, and we don't share it for cross-context behavioral advertising.

9. How long we keep information

• Demo and trial requests: up to 24 months after our last contact with you, unless you become a customer.
• Account and usage data: for as long as your account is active, and afterwards for a limited period to resolve disputes and enforce our agreements.
• Billing records: as long as tax and accounting laws require, generally up to 7 years.
• Business Contact Data: while the business is relevant to the Service. We regularly refresh records and remove those that are outdated.
• Removal requests: if you ask us to remove your information, we keep a minimal record, such as the email address or business website, so that we don't collect or contact it again.
• Server logs: kept by our hosting provider for a short period under its own policies.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it;
• correct information that is inaccurate or incomplete;
• delete your information;
• object to our processing, including at any time to processing for direct marketing;
• restrict our processing in certain circumstances;
• receive your information in a portable format;
• withdraw your consent where we rely on it;
• lodge a complaint with a data protection authority: in the EEA, your local supervisory authority; in the UK, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To exercise these rights, email samet@waveone.io. We respond within 30 days. We may need to verify your identity before acting on a request, and we don't charge a fee unless the law allows it. Every marketing email we send includes an unsubscribe link.

11. Removing a business from Wave

If you own or run a business that appears in Wave, or your contact details appear in our data, email samet@waveone.io with the business name and website, or the email address or phone number you want removed. We will:

• remove the information from our database and from future bulletins;
• add it to our suppression list so that it isn't collected again;
• confirm by email, usually within a few business days and at the latest within 30 days.

Customers who have already received your information are required by our Terms of Use to honor opt-out requests. You can also ask any company that contacts you to stop.

12. Additional information for US residents

Some US states, including California, Colorado, Connecticut and Virginia, give residents specific rights over their personal information.

• Categories we collect: identifiers (such as name, email address, phone number and IP address); commercial information (such as your plan and billing history); internet activity (such as logs and usage data); professional information (such as company, role and business contact information); and inferences (such as fit scores about businesses).
• Sources: you, your devices, publicly available sources and our service providers.
• Purposes and recipients: as described in sections 6 and 8.

Providing Business Contact Data to our customers may be considered a "sale" of personal information under some state laws. You can opt out of this, and ask to know, correct or delete your information, by emailing samet@waveone.io with the subject "Do Not Sell" or "Privacy request". You can use an authorized agent to make a request for you. We won't discriminate against you for exercising your rights, and we don't knowingly sell or share the personal information of anyone under 16.

13. International data transfers

Wave is based in the United States, and our service providers process information in the United States, the European Union and other countries. When we transfer personal information from the EEA, the UK, Switzerland or Türkiye, we use the safeguards the law requires, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and, for Türkiye, the standard contracts and other mechanisms set out in Article 9 of KVKK.

14. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS), access controls and service providers with established security programs. No method of transmission or storage is completely secure, so we can't guarantee absolute security. To report a security issue, email samet@waveone.io.

15. Children

The Website and the Service are intended for businesses and are not directed to children under 16. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top and, if the changes are material, notify customers by email or through the Service before they take effect.

17. Contact us

Wave Intelligence, Inc.
Email: samet@waveone.io